On 14 April 1988 — three years after symbolics.com became the first commercial domain, two years after Germany registered its first six .de names — Spain received delegation of .es from IANA. For the next seventeen years, almost nothing happened. Registration required a Spanish trademark, an exact-match company name, or a citizen's first name plus surname. Common words were forbidden. Place names were forbidden. The minimum length was three characters, and the only domains shorter than that — hp.es, pp.es — were grandfathered. By 2005, .es had roughly 50,000 registrations. Germany's .de had passed five million in 2001.
Then, in November 2005, Spain liberalized. Direct .es second-level registration opened to anyone in the world, with no Spanish presence required. Twenty years later, in mid-2025, the registry counts 2,134,104 .es domains — a respectable number for a country of 47.5 million, but a fraction of .de's 17.7M, .nl's 6.1M, or even Brazil's 5.5M. The naive read is that Spain liberalized too late and never caught up. The data tells a different story: Spain's national digital identity didn't fail to scale on .es. It fragmented into four parallel TLDs — .es, .cat, .gal, .eus — administered by four different organizations under three different legal regimes, governing the four official languages of a plurinational state.
We analyzed 10,152,836 hostnames under .es in the DomainsProject crawl (snapshot 17 March 2026), cross-referenced against Red.es's official 2024 statistical report, the dominios.es July 2025 update, the WIPO Lex archive, the Cofense and Spamhaus 2025 abuse trackers, the FTTH Council Europe ranking, and the contemporaneous record of the September 2017 Civil Guard raid on the .cat registry.
The headline: .es is structurally unlike its peers. It is a state-owned namespace whose observable web is dominated by a single ISP's reverse-DNS pattern, whose subdomain experiments (.nom.es, .gob.es) barely exist online despite being in the registry, whose stateless-nation alternatives (.cat, .gal, .eus) carry the cultural weight that .de and .nl carry for their nations, and which in early 2025 inverted from "low-abuse EU ccTLD" to the #3 most-abused TLD globally — a 19× phishing surge consistent with the structural risks of a cheap, channel-concentrated, CDN-decoupled registry.
The Data
DomainsProject continuously crawls and indexes hostnames across every delegated TLD in the IANA root zone. For .es, the snapshot used in this post breaks down as follows.
| Category | Count | Coverage |
|---|---|---|
| Active TLDs tracked | 1,519 | 100% of IANA root zone |
| Total domains indexed | 2.3B+ | Largest public dataset |
.es hostnames observed |
10,152,836 | 0.44% of dataset |
.es unique apex domains |
~2,035,758 | Subdomain multiplier 4.99× |
Red.es registered .es (end 2024) |
2,094,772 | Official registry |
Red.es registered .es (31 July 2025) |
2,134,104 | Official registry |
The 10.15M crawl figure exceeds the 2.13M registry figure because we count distinct hostnames — every dynamic.jazztel.es reverse-DNS entry, every subdomain.example.es, every wp.<site>.es. The registry counts only registered second-level (and a small set of registered third-level) domains. Both numbers describe the same namespace from different angles.
Methodology
What we count. A hostname appears in our dataset when our crawler observed it resolving in the DNS over the rolling crawl window. We deduplicate exact strings; we do not deduplicate by IP, certificate, or content. www.example.es and example.es count as two hostnames if both resolve.
Apex extraction. For each hostname, we identify the apex by walking from the right. Direct .es apex is the rightmost two labels (e.g. example.es). For Spain's six second-level zones (.com.es, .org.es, .nom.es, .gob.es, .edu.es), the apex is the rightmost three labels (e.g. example.com.es). All other strings to the left of the apex are treated as subdomains.
Classification labels used in this post.
- "Direct
.es": an apex domain registered directly under.es(example.es). - "Third-level apex": an apex registered under one of the six administered second-level zones (
example.com.es). - "ISP infrastructure subdomain": a hostname matching reverse-DNS conventions like
<ip-pattern>.dynamic.<isp>.<tld>or<id>.ddns.<isp>.<tld>. We classifieddynamic.jazztel.esas ISP infrastructure based on hostname structure (rDNS-style IP-derived labels), not based on inspection of the hosted content. - "Cultural-fidelity ratio" (used for
.eus): the share of resolving hostnames whose primary content is in the sponsored language. We rely on the PuntuEus Observatory's published 90% figure rather than re-running content classification.
Known limitations. Our crawler under-observes domains that never resolve outside the registrant's country, are not linked from the wider web, or are parked at registrar nameservers we don't probe. We therefore systematically under-count dark portfolios and over-count portfolios with heavy subdomain scaffolding (CDN edge nodes, blogging platforms, ISP rDNS). The 199-200 hostname ceiling visible in our long tail of .es apex counts (see the apex distribution chart below) reflects a per-host crawl cap, not a real plateau in those domains' subdomain populations.
Dataset vs. registry counts. Where our crawl-based ratios diverge from registry counts, we report both and the inferred multiplier. Heavy outliers (Jazztel, Blogspot) explain most of the gap. The gap is itself the finding: in .es, two operators account for a quarter of all observable hostnames.
Reproducibility. The full dataset is available at domainsproject.org/dataset. The aggregations in this post can be reconstructed with a single GNU awk pass over the country file.
The Scorecard
.es Among Top Country-Code TLDs
| Rank | ccTLD | Country | Domains (registry, latest) | Per capita |
|---|---|---|---|---|
| 1 | .de |
Germany | 17.7M | 1 per 4.7 |
| 2 | .uk |
United Kingdom | 10.3M | 1 per 6.6 |
| 3 | .nl |
Netherlands | 6.1M | 1 per 2.9 |
| 4 | .br |
Brazil | 5.5M | 1 per 38.7 |
| 5 | .cn |
China | ~22M | 1 per 64 |
| — | .es |
Spain | 2.1M | 1 per 22.7 |
Spain registers one .es domain per 22.7 inhabitants — between Brazil's 1-per-38.7 and the United Kingdom's 1-per-6.6, but in a country with broadband penetration (97.4% per Eurostat, December 2025) closer to the UK than to Brazil. The gap is structural, not infrastructural.
Spain's Plurinational Namespace
| TLD | Type | Registry | Registered | Per nominal speaker |
|---|---|---|---|---|
.es |
ccTLD | Red.es (state) | 2,134,104 | 1 per 22 (citizens) |
.cat |
sTLD | Fundació puntCAT | ~113,000 | 1 per 88 (Catalan speakers) |
.eus |
sTLD | PuntuEus | ~15,600 | 1 per 48 (Basque speakers) |
.gal |
sTLD | Asociación puntoGAL | ~7,400 | 1 per 324 (Galician speakers) |
Per speaker of the nominal language, .eus is the most densely-adopted regional sponsored TLD on Earth. Basque has roughly 750,000 speakers and 15,600 .eus domains — a density that exceeds .cat's reach into the much larger Catalan-speaking community. Galician's .gal lags both, and the absolute numbers across all three plurinational TLDs combined (~136,000) total less than 7% of .es. The mass-adoption ceiling is real, but the per-speaker densities are real too — and they are achieved under content-eligibility rules that .es does not impose.
From Postage Stamp to Public Square: The 2005 Liberalization
For its first seventeen years, .es operated under what the Wikipedia editors politely call "expensive and encumbered" rules. The actual policy was more restrictive than that phrasing suggests:
- Trademark or company-name match required. A registrant had to provide an exact-match Spanish trademark certificate or the registered business name. No fanciful brands, no portfolios, no speculation.
- Common words and place names disallowed. A blanket prohibition that excluded most of the namespace small businesses would naturally reach for.
- Three-character minimum. The exceptions —
hp.es,pp.es— were grandfathered from the academic era. Two-letter direct registrations remained closed for decades. - Personal names: only "first name plus first surname" — and even that was contested.
- One domain per holder. Registrants couldn't accumulate.
- High prices. Pre-liberalization annual fees ran into the thousands of pesetas, well above the eventual €4-€10 retail bands.
The cumulative effect was that Spanish businesses and individuals who wanted a domain registered .com instead. By 2005, .com had achieved cultural hegemony in Spain that other European countries had broken with their domestic ccTLDs. Liberalization came in stages through 2005, formalized by Order ITC/1542/2005 of 19 May 2005, and culminated in November 2005 with the opening of direct .es second-level registration to anyone worldwide — no Spanish residency, no trademark, no company-name match.
The result was real but bounded growth. Registrations rose from roughly 50,000 to over a million within four years, and to two million by 2018. Then they plateaued. The end-2024 count of 2,094,772 was actually slightly lower than end-2023's 2,095,642 — .es's first effectively flat year on record. The mid-2025 figure rebounded to 2,134,104 (+1.9% over seven months), but the broader pattern is a registry that has reached its addressable market under current conditions.
Red.es: A State-Owned Registry With Cooperative-Style Pricing
The institution behind .es is unlike both the for-profit Verisign model (.com) and the cooperative DENIC model (.de). Red.es is an Entidad Pública Empresarial — a Public Business Entity attached to the Ministry for Digital Transformation and Public Administration, created by Royal Decree 164/2002 of 8 February 2002, with statutes amended by Royal Decree 351/2011. Its mandate extends well beyond the registry: Red.es also operates RedIRIS (Spain's national research and education network) and runs digital adoption programs for SMEs and public administrations.
The pricing structure that emerged from this state ownership is striking: it looks like cooperative pricing, not government rent extraction.
Red.es Wholesale Fee Schedule (Director General Instruction)
| Domain class | Direct from Red.es | Via accredited registrar |
|---|---|---|
.es (second level) |
€27.59/yr | €4.09/yr |
.com.es / .org.es / .nom.es (third level) |
€11.64/yr | €1.29/yr |
.edu.es / .gob.es (third level) |
€30.17/yr | €10.34/yr |
Red.es prices direct registration at 6.7× the channel rate, and prices third-level .com.es at 32% of the second-level .es rate. Both decisions are policy, not cost recovery. The 6.7× direct premium pushes virtually all retail registration through the 106 accredited registrars (up from 12 in 2004). The 3.2× cheaper third-level pricing keeps .com.es viable as a fallback when the registrant's .es apex is taken — which is why our dataset still finds 696,480 .com.es hostnames in 2026.
Red.es vs. peer registries
| Metric | Red.es (.es) |
DENIC (.de) |
SIDN (.nl) |
Verisign (.com) |
|---|---|---|---|---|
| Legal form | Public Business Entity | Cooperative (eG) | Foundation + BV | For-profit (NASDAQ) |
| Wholesale price | €4.09 | €2.20 | €4.38 | $10.26 |
| Registrations | 2.13M | 17.7M | 6.1M | 161M |
| Accredited registrars | 106 | ~300 | ~1,058 | thousands |
| Top-5 registrar concentration | 45.2% | <30% | <40% | <25% |
Red.es's registrar channel is the most concentrated of any major European ccTLD: the top five registrars (IONOS at 17.7%, ARSYS, SCIP, REGISTRAR.EU, ACENS TECHNOLOGIES) hold 45.2% of all registrations. IONOS alone — a German hosting giant — administers 369,895 .es domains, more than the entire registered .cat namespace combined. The implication is that Spain's .es distribution is heavily intermediated by international hosting consolidators rather than by domestic specialist registrars, despite the regulatory framework being entirely Spanish.
The Jazztel Effect: When 21% of a Country's Namespace Is One ISP
Within the 10.15M observable .es hostnames, a single apex domain accounts for 2,171,723 entries — 21.4% of the entire dataset. That apex is jazztel.es. The pattern is immediately recognizable on inspection: subdomains of the form <ip-octet>.<ip-octet>.<ip-octet>.<ip-octet>.dynamic.jazztel.es, reverse-DNS records auto-generated for residential broadband customers.

Jazztel was founded in Madrid in 1997 by the Argentine entrepreneur Martin Varsavsky as an independent challenger to Telefónica's incumbent fixed-line network. Unlike most Spanish challengers, it built its own infrastructure rather than reselling Telefónica capacity. After a turbulent dot-com period, Orange España agreed to acquire Jazztel in September 2014 for €3.4B, the EU Commission cleared the deal on 19 May 2015 subject to conditions, the tender completed on 18 August 2015, and Jazztel was fully merged into Orange Espagne S.A.U. in February 2016. As a legal entity, Jazztel ceased to exist a decade ago.
The DNS, however, is a fossil layer. The dynamic.jazztel.es reverse zone is still authoritative for millions of customer IP addresses on what used to be the Jazztel network and is now Orange's, and Orange has not consolidated reverse-DNS into a unified orange.es zone. Every PTR query for one of those IPs still resolves to a *.dynamic.jazztel.es hostname, which then appears in any forward crawl that follows the reverse pointer. The result is that a brand that legally ceased to exist in 2016 still generates more observable Spanish web hostnames than every Spanish federal ministry combined.
Apex concentration vs. peer ccTLDs
| ccTLD | Largest single-apex share | Apex |
|---|---|---|
.es (Spain) |
21.4% | jazztel.es |
.nl (Netherlands) |
22.3% | ziggo.nl (cable ISP) |
.net (gTLD) |
~22.5% | comcast.net |
.uk (UK) |
~7% | virginmedia.com |
.de (Germany) |
<5% | (more fragmented) |
.es and .nl are the two major European ccTLDs where one ISP's reverse-DNS dominates the observable namespace. The Netherlands' Ziggo and Spain's Jazztel-now-Orange occupy structurally identical positions: a national broadband challenger that scaled fast, exposed reverse-DNS as <ip>.<isp-domain>, and got snapshot-frozen into a permanent fraction of the country's crawled domain space. Germany — where the largest residential ISP, Deutsche Telekom, never adopted a high-cardinality reverse zone under .de — shows none of this concentration.
The Subdomains That Don't Exist
The mismatch between .es registry counts and DomainsProject crawl counts becomes structural when we drop below the second level.
Registry vs. Observable, by Second-Level Zone
| Zone | Registered (Red.es 2024) | Observed hostnames (DP) | Ratio (host/reg) |
|---|---|---|---|
.es (direct) |
2,009,933 | 9,427,394 | 4.69× |
.com.es |
73,429 | 696,480 | 9.49× |
.org.es |
6,878 | 26,994 | 3.92× |
.edu.es |
509 | 1,803 | 3.54× |
.nom.es |
2,819 | 99 | 0.035× |
.gob.es |
1,204 | 66 | 0.055× |

.nom.es is the most striking finding in the entire dataset: 2,819 personal domains are registered, and only 99 hostnames under any of them appeared in our crawl. The .nom.es zone — Spain's "personal use" namespace — exists almost entirely as a dark portfolio. Registrants pay €1.29/year wholesale to hold a name they will likely never publish content under. Some of these are defensive registrations by individuals; some are protective by trademark holders; almost none are operational websites.
.gob.es shows the opposite pattern: tiny apex count, high concentration. The 66 observed hostnames cover Spain's central government estate — lamoncloa.gob.es (the Prime Minister's office), sanidad.gob.es (Health), interior.gob.es (Interior), educacion.gob.es (Education), seg-social.gob.es (Social Security), and the unified administration portals (administracion.gob.es, transparencia.gob.es). The 1,204 registered .gob.es domains likely include defensive registrations and sub-agency holdings that resolve only to redirects toward the small set of canonical hosts, which is exactly what we see crawled.
.edu.es is functionally a private-academy zone. Spain's public universities use direct .es (upv.es, uam.es) or, in many cases, .edu (ub.edu) — they predate the .edu.es carve-out. The top observed .edu.es apexes — fp.edu.es, euroinnova.edu.es, oposicionesdocentes.edu.es — are vocational-training and exam-prep brands, not state higher education.
.com.es is the inverse: 73,429 registrations generate 696,480 observable hostnames at a 9.49× multiplier, the second-highest in our table. The reason is one apex: blogspot.com.es, Google's geo-localized Blogger redirect, accounts for 449,508 of the 696,480 hostnames (64.5%). Strip out blogspot and the multiplier collapses toward the .org.es baseline. The implication is that .com.es's observable footprint depends heavily on a single legacy product owned by a foreign vendor; if Google sunsets Blogger, the observable namespace contracts sharply.
A Plurinational Internet: .cat, .gal, .eus
Spain is a state with one official language (Castilian Spanish) and three co-official regional languages with constitutional standing in their respective autonomous communities: Catalan in Catalonia, the Balearic Islands, and Valencia (where it is officially called Valencian); Galician in Galicia; and Basque in the Basque Country and parts of Navarre. Each of these communities runs its own sponsored top-level domain, approved by ICANN under the sTLD model, governed by a community foundation, with eligibility rules requiring content in the relevant language.
This is unusual. France runs .fr and a few overseas-territory ccTLDs. Germany runs .de and operates inside an EU framework with .eu. The United Kingdom runs .uk and tolerated .scot and .wales as gTLDs without strong adoption. Spain's plurinational TLD architecture — three sponsored regional TLDs adopted with non-trivial scale, all approved by ICANN, none of them owned or controlled by Madrid — is a unique configuration.
The Three Plurinational TLDs
| TLD | ICANN approval | Delegated | Registry | Registered | Speakers |
|---|---|---|---|---|---|
.cat |
16 Sep 2005 | 19 Dec 2005 | Fundació puntCAT | ~113,000 | ~10M |
.gal |
7 Nov 2013 | 11 Apr 2014 | Asociación puntoGAL | ~7,400 | ~2.4M |
.eus |
10 Jun 2013 | 11 Apr 2014 | PuntuEus | ~15,600 | ~750K |

.cat was the first sponsored TLD ever approved by ICANN for a language community. Its September 2005 approval predates the entire ICANN sTLD wave for cultural-linguistic communities and remains the model that .gal, .eus, .scot, .bzh, and others copied. Eligibility requires that registrants either belong to the Catalan-speaking community, hold a special registration code, develop activities promoting Catalan culture in any language, or be endorsed by three existing .cat holders. Registrants must publish primarily-Catalan content within six months. The TLD is non-territorial: a Catalan organization in Mexico City can register a .cat domain on the same terms as one in Barcelona.
The flagship .cat holders form a coherent cultural-political brand: FC Barcelona at fcbarcelona.cat, the Generalitat de Catalunya at gencat.cat, the Catalan Wikipedia, the Ara newspaper, the Museu Nacional d'Art de Catalunya, the Teatre Nacional de Catalunya. The roster reads as the institutional infrastructure of a stateless nation that chose the Domain Name System as one of the places to project that infrastructure.
.eus — the densest community TLD on Earth
PuntuEus's January 2024 reported total of 15,599 registered .eus domains translates to roughly 1 domain per 48 Basque speakers — the highest density of any sponsored language TLD globally. Crucially, the PuntuEus Observatory measures that 90% of .eus content is actually in Basque, against 0.1% of the global web in Catalan and a similarly small share in Basque overall. By the per-speaker density and cultural-fidelity metrics reported by PuntuEus, .eus has the strongest case of any sponsored language TLD delegated to date.
.gal — the smallest, the most institutional
.gal registers a comparatively modest ~7,400 domains, and its registry — Asociación puntoGAL — counts the Real Academia Galega among its members, alongside the Galician public broadcaster, dinahosting (Galicia's hosting champion that co-funds .gal events), and major cultural institutions. The first 93 .gal sites went live on 25 July 2014, Día Nacional de Galicia. The TLD is small but institutionally dense: it functions less as a mass-adoption namespace and more as a curated identity space for Galician-language public institutions and cultural NGOs.
The .cat Raid: When a Western Democracy Police-Raided a TLD Registry
On 20 September 2017 — eleven days before the planned 1 October Catalan independence referendum — agents of Spain's Civil Guard entered the Barcelona offices of Fundació puntCAT under judicial order. They seized computers, arrested CTO Pep Masoliver on charges of sedition, and demanded that .cat domains hosting referendum-related content be deleted. Some were.
It was, and remains, the only known raid by the police of a Western democracy on the operational offices of a TLD registry over content disputes. The Electronic Frontier Foundation called it "unprecedented." The puntCAT Foundation called it "shameful and degrading, unworthy of a civilized country."
The technical impact was bounded — puntCAT's actual DNS operations are run by an external operator, so the namespace remained resolvable throughout the raid and Masoliver was released within days. The political impact was not bounded. The raid demonstrated, in concrete legal-procedural terms, that:
- A registry's compliance posture toward state takedown demands is a single point of pressure that can be reached with a court order and a search warrant, even when the registry is structurally a non-profit foundation.
- The choice of an external DNS operator was, in puntCAT's case, the difference between content-level compliance pressure and infrastructure-level disruption.
- The community-foundation governance model that ICANN encouraged for sponsored language TLDs does not by itself protect against state coercion when the registry is physically located in the state whose policy positions are at issue.
These lessons have been absorbed by every sponsored TLD operator that has spent any time thinking about state pressure since 2017. They were not absorbed in the ICANN policy framework, which still treats the puntCAT raid as an exceptional national matter rather than a structural lesson for sponsored TLD operators worldwide.
Punycode With Eñes: Spain's IDN Pioneer Move
On 2 October 2007 at 06:00 CEST, Red.es opened registration of internationalized .es domains containing the full character set of Spain's four official languages: Castilian (á à é è í ï ó ò ú ü ñ), Catalan (Ç, the l·l middle dot), Basque, and Galician. The launch came with a 28-day sunrise window (through 30 October 2007) reserved for holders of .es domains registered before 1 June 2007, who could claim the multilingual variants of their existing names.
Spain's IDN launch was nearly three years before ICANN's 2010 IDN-ccTLD program (which let countries register whole TLDs in non-Latin scripts like .рф for Russia or .中国 for China). On the second-level, Spain was a vanguard.
More importantly, Red.es made a plurinational IDN choice: it included Catalan, Basque, and Galician characters in the same .es registry rules from day one. There was no separate .es namespace for Castilian and a different one for Catalan. A Catalan organization could register palau-de-la-música.es on the same legal terms as a Castilian organization registering niño.es. The .es IDN policy was — and remains — one of the most explicit registry-level acknowledgments of Spain's plurinational character that any Spanish state body has issued.
Encoded in DNS, these names became Punycode strings: españa.es becomes xn--espaa-rta.es; niño.es becomes xn--nio-9la.es; palau-de-la-música.es becomes xn--palau-de-la-msica-30b.es. The browser shows the Unicode form; the wire carries the ACE form; both work. Twenty years after liberalization and nineteen after IDN launch, the Punycode-encoded .es zone remains a small but operational fraction of Spanish web identity.
The 2025 Phishing Inversion
The narrative on European ccTLDs is supposed to be that they are low-abuse spaces. Stricter eligibility rules, no bulk pricing, channel-only retail registration, and the implicit threat of registry takedown action under EU consumer protection law all conspire to keep abuse operators moving toward .com, .top, .zip, and free-domain providers. ICANN's Inferential Threat Hosting Index reflects this: most EU ccTLDs sit in the lowest-abuse decile.
Then, in early 2025, .es abuse increased 19× from Q4 2024 to Q1 2025. By May 2025, Cofense was tracking 1,373 malicious subdomains across 447 base .es domains — and .es had climbed to the #3 most-abused TLD globally for credential phishing campaigns. 99% of the malicious sites were hosted on Cloudflare, and 99% were credential phishing (the remaining 1% delivered remote-access trojans).

Three structural factors enabled the surge:
- The €4.09 wholesale fee is low enough to be attractive for short-lived abuse portfolios when amortized across thousands of domains. It is not as cheap as
.topor free-domain providers, but it sits in a band where the trust premium of an EU ccTLD outweighs the per-domain registration cost. - Reseller-driven channel concentration — IONOS at 17.7%, top-5 at 45.2% — means a small number of compliance teams set the takedown velocity for the entire namespace. When abuse operators identified the channels with the slowest abuse-response SLA, they were able to scale registration through that single chokepoint.
- Cloudflare hosting concentration decoupled the registry response from the abuse response. Even when Red.es and registrars suspended a base domain, the Cloudflare-fronted phishing pages remained reachable for the duration of the DNS propagation and Cloudflare's own takedown queue.
The historical baseline is not wrong — .es was, until Q1 2025, a low-abuse EU ccTLD. The inversion is real, and it exposes a structural risk that applies to every EU ccTLD with a similar fee/concentration/CDN profile. Red.es has begun to respond (publishing security communiqués and tightening registrar SLA monitoring) but the namespace will likely live with elevated abuse rates through 2026.
What's at Stake
- One ISP's legacy reverse-DNS controls 21% of Spain's observable web — a fragility specific to
.esand.nlthat does not affect.de. If Orange chose to consolidate reverse-DNS underorange.estomorrow, the Spanish.esweb's apparent footprint would shrink by a fifth overnight, with no actual loss of content. The metric is not the namespace. - Spain's
.nom.espersonal-domain experiment is effectively dead. 2,819 registered, 99 observable. Twenty-one years after liberalization, Spaniards have not adopted personal domain identity at scale — at least not on the namespace Red.es created for it. - The plurinational TLD architecture is structurally sound but politically vulnerable.
.cat,.gal, and.eushave demonstrated viability, but the 2017 Civil Guard raid on puntCAT showed that registry-level state pressure is a credible threat in a Western democracy. Sponsored TLD operators with politically-charged community mandates need contingency plans that the ICANN framework does not require them to have. - The 2025 phishing surge inverted
.es's abuse profile from low-decile to #3 globally in a single quarter. The structural risk — low fees + channel concentration + CDN decoupling — applies to multiple EU ccTLDs and may foreshadow further surges elsewhere. .com.essurvives almost entirely as Google Blogspot's geo-redirect (449K of 696K observed hostnames). When Google sunsets Blogger, the observable.com.esnamespace will collapse to roughly the size of the.org.esnamespace. The structural fragility is one product manager's roadmap decision away from materialization.- IONOS administers more
.esdomains than the entire.catregistry. A single German hosting consolidator's compliance posture has more weight on the Spanish national namespace than the entire institutional infrastructure of Catalan-language internet identity. This is not a problem Spain created; it is a problem that the global hosting consolidation wave has imposed on every smaller ccTLD.
What Would Help
1. Registries: publish observable-vs-registered ratios. Red.es's 2024 statistical report is excellent on registered counts, registrar concentration, and geographic distribution, but does not report DNS-resolution rates per second-level zone. Publishing the share of .nom.es registrations that resolve a website would let the public understand which namespaces are operational and which are dark portfolios.
2. Sponsored TLD operators: separate registry function from physical office. The 2017 puntCAT raid was technically bounded because DNS operations were externalized. Every sponsored TLD with a politically-charged community mandate should adopt the same separation explicitly, with documented continuity-of-operations procedures for the case of state action against the registry foundation.
3. EU ccTLD operators: tighten registrar SLA monitoring on abuse-response time. The 2025 .es phishing surge concentrated through a small number of channels with weak abuse-response posture. Registry-mandated abuse-response SLAs, with audited compliance and escalating sanctions, would make the same scaling pattern less attractive for operators considering .fr, .it, .pt, or .eu next. Browse our TLD statistics to see how concentration patterns vary across European registries.
4. Researchers: stop counting Jazztel. When .es is benchmarked against other ccTLDs on hostname count, the figures are systematically inflated by dynamic.jazztel.es. Best practice for cross-ccTLD comparison should be to either exclude reverse-DNS infrastructure subdomains or to report a "non-rDNS hostname count" alongside the raw figure. Our .es non-rDNS count is closer to 7.98M than to 10.15M.
5. Spanish public administration: adopt .gob.es more actively. The 1,204 registered .gob.es domains generate 66 observable hostnames — a usage ratio that suggests massive defensive registration without operational deployment. A government-wide policy of preferring .gob.es over generic alternatives for new digital services would bring observable usage closer to registered count and would make the "this is an official Spanish government service" signal more legible to citizens. Compare to .gouv.fr in France, which carries a much stronger trust signal because the namespace is reserved and used.
Methodology and sources: This analysis used the DomainsProject .es country file (10,152,836 hostnames, snapshot 17 March 2026); Red.es's official 2024 statistical report (2,094,772 registrations end-2024) and dominios.es's 31 July 2025 update (2,134,104); Royal Decree 164/2002 statutes via WIPO Lex; the September 2017 EFF and Fortune coverage of the Civil Guard raid on puntCAT; the Cofense (May 2025) and Register (5 July 2025) coverage of the .es phishing surge; the FTTH Council Europe Global Ranking 2024; DataReportal's Digital 2024 Spain report; the European Commission's Orange/Jazztel merger filings; the Wikipedia, ICANNWiki, and registry-foundation pages for .es, .cat, .gal, and .eus; and the dominios.es Spanish-character IDN launch documentation from October 2007. Detailed source list and full numerical workings are in the research file. Explore the DomainsProject statistics dashboard and the full dataset.